Cloud Security Podcast by Google EP270 The Convenience Tax: Why We Keep Failing at Supply Chain Security
4 snips
Apr 6, 2026 
Dan Lorenc, founder and CEO of Chainguard focused on software supply chain security. He discusses security tools becoming attack surfaces. He tackles tag mutability and failed version pinning. He covers long-game social engineering, auto-update trade-offs, SBOM limitations, and hardening CI/CD to reduce credential exposure.
AI Snips
Chapters
Books
Transcript
Episode notes
Supply Chain Attacks Scale Like Fishing With Nets
- Supply chain attacks are inevitable and fractal because attackers target widely used tools to capture credentials across many victims.
- Dan Lorenc described the Trivy compromise that stole terabytes of CI secrets and then propagated malware into other projects, multiplying impact.
Trivy Compromise Stole Terabytes Of CI Secrets
- Dan Lorenc recounted a mid-March compromise that stole CI credentials from many popular open-source projects.
- He described that stolen terabytes of data were later used to inject malware into Trivy, which then sealed more secrets for attackers to analyze.
Attackers Fish With Nets Not Spears
- Supply chain attacks shift attacker incentives because hardened perimeters force attackers to fish for victims via widely shared dependencies.
- Dan Lorenc compared this to fishing with nets: compromise a supplier and the blast radius catches many indirect victims.
